![](\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2021\/09\/Intro-to-GraphQL-Attack-Scenarios-2-1024x535.png\" "\\"Intro")
<\/p>\n<\/p>\n
GraphQL is one of the commonly used open-source manipulation and data query language for APIs, and runtime for implementing queries for preexisting data. It also serves as an efficient alternative to traditional REST API queries. This open-source language is not associated with a specific backend, which means that it interacts with existing code and data. The client interacts with the GraphQL service, which then interacts with the database via query resolvers during execution.<\/p>\n
It enforces a strict typing system, and data is described in a well-defined GraphQL schema. It enables clients to craft a GraphQL query and get what they need. Their schemas can be massive, and from a hacker\u2019s perspective, this presents new challenges. The foundational knowledge of the GraphQL schema and proper tools for automation is necessary to plan an attack.<\/p>\n
![\"Intro](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/tmp_1630653997687.png\")
<\/h3>\nImageSource: https:\/\/devopedia.org\/graphql<\/a><\/p>\n The above image contains a query operation on the object \u2018paste\u2019. The object takes an argument \u2018pId\u2019, which is a string, and a variable \u2018$pId\u2019. It is also defined to make this argument dynamic.<\/p>\n <\/p>\n Some common examples for GraphQL endpoints are listed below.<\/p>\n Browse SecLists some popular graphql wordlist.<\/p>\n Check for parameters that resemble GraphQL query structure, then locate hidden endpoints by looking out for keywords in the HTML source of your web application or files such as, \u201cquery \u201c, \u201cmutation \u201c, \u201cgraphql\u201d.<\/p>\n However, the endpoints do not have to follow any specific naming convention. Applications in the wild are known to host their GraphQL service on a separate domain e.g.,graphql.example.com.<\/p>\n After identifying a GraphQL endpoint, the first step would be an introspection query. Most GraphQL instances have introspection enabled by default.<\/p>\n An introspection query is used to probe a GraphQL service for information about the types, queries, mutations & fragments of the available GraphQL schema. This feature allows anyone to see the layout of the entire schema. If the introspection is documented by the developers, then it can be accessed by the GraphQL endpoint via its interactive console (usually \/graphiql<\/em>).<\/p>\n A comprehensive request to perform GraphQL introspection(if enabled) is shown in the following image:<\/p>\n Visit Payloads All The Things to learn more information on the URL encoded & URL decoded variants of the GraphQL introspection query. Tools like GraphQL Raider and InQLare used to gather information about queries and mutations.<\/p>\n We will be looking at a couple of attacks that consist of scenarios specific to the GraphQL implementation like Batched Queries and DoS from Nested Queries. However, classic attacks like SQL injections, Rate Limiting, and Improper Authorization also affect GraphQL implementations.<\/p>\n <\/p>\n Batched Queries Attack<\/strong><\/p>\n GraphQL supports query batching. It enables the client to batch multiple queries or collect the request for multiple object instances through a single GraphQL API call.<\/p>\n This feature of grouping can be abused to create a form of brute force attack. As the client can query the same object multiple times with different arguments in a single API call, this attack is not as easily detectable as the usual brute force attack. This is because normally brute-force attacks utilize a massive number of requests. Here is an example of query batching:<\/p>\n In this example, the \u2018systemDiagnostics\u2019 operation (or object) is being queried multiple times with different values passed in the arguments for individual queries. This attack will likely bypass any existing rate limits in the application and will assist the attacker significantly in enumerating a large number of objects. To mitigate this type of attack, it is recommended to prevent batching for sensitive objects and implement object request rate-limiting in code.<\/p>\n <\/p>\n Denial of Service<\/strong><\/p>\n In GraphQL, query depth limitation is disabled by default, hence nested queries of massive depth can be executed to cause a denial-of-service attack on the GraphQL service. Because of the nature of the GraphQL query language, multiple queries can be nested one inside the other (refer to the image).<\/p>\n In GraphQL, when object types reference each other, it is often possible to build a circular query that grows exponentially to a point it could bring the server down due to resource exhaustion. In the example shown above, the application offers two object types, namely Owner and Paste, which reference each other (an owner has a paste, and a paste has an owner), permitting a recursive query to be carried out successfully.<\/p>\n Setting a max_depth for queries can help mitigate this type of attack. The max_depth functionality is the maximum level of depth allowed for a query, ensuring deeply constructed queries will not be accepted by GraphQL.<\/p>\n <\/p>\n If you would like to delve deeper into this topic, here are some recommended resources:<\/p>\n <\/p>\n Author,<\/p>\n Akshay Khilari<\/strong><\/p>\n Attack & PenTest Team<\/p>\n Varutra Consulting Pvt. Ltd.<\/p>","protected":false},"excerpt":{"rendered":" Introduction GraphQL is one of the commonly used open-source manipulation and data query language for APIs, and runtime for implementing queries for preexisting data. It…<\/p>\n","protected":false},"author":4,"featured_media":16961,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[264,285,272],"tags":[495,499,497,498,494,496],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tGraphQL Terminology<\/strong><\/h3>\n
\n
![\"GraphQL](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/GraphQL-Terminology.png\")
<\/p>\nFinding GraphQL endpoints<\/strong><\/h3>\n
\n
<\/h3>\n
Introspection<\/strong><\/h3>\n
![\"GraphQL](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/GraphQL-introspection.png\")
<\/p>\n<\/h3>\n
Common <\/strong>GraphQL <\/strong>Attack Scenarios<\/strong><\/h3>\n
![\"GraphQL](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/GraphQL-Batched-Queries-Attack.png\")
<\/p>\n![\"GraphQL](\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/09\/GraphQL-Denial-of-Service.png\")
<\/p>\nReferences and further reading<\/strong><\/h3>\n
\n